What you need to know today.
Critical PHP and GitLab vulnerabilities are actively exploited, alongside numerous critical flaws in network devices.
A critical vulnerability in PHP, CVE-2026-109618, allows for out-of-memory errors to lead to uninitialized memory states, potentially enabling request handling to be compromised. This flaw, alongside CVE-2026-109619 which describes a similar issue with global state management in PHP, has been actively exploited. News outlets report that these vulnerabilities are being used in attacks, with some sources indicating that Chinese actors are chaining these PHP flaws with other exploits, such as those targeting Palo Alto Networks firewalls, to gain root access on compromised servers. The attacks appear to focus on internet-exposed management interfaces, and while some reports suggest widespread exploitation, others indicate that certain platforms like WordPress may not be affected. (Cyber Security News, The Register Security, GovInfoSecurity)
GitLab has addressed a critical vulnerability, CVE-2026-97229, that could permit unauthenticated users to execute arbitrary code under specific conditions. This flaw affects multiple versions of GitLab CE/EE. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, highlighting its active exploitation. Reports indicate that attackers have attempted to exploit this vulnerability, with some sources noting its exploitation against Alpine Linux. (The Hacker News, SecurityWeek, Vypr Intelligence)
A significant number of critical vulnerabilities have been identified across various Wavlink router models, including CVE-2026-120345, CVE-2026-120281, CVE-2026-120280, CVE-2026-120279, CVE-2026-120277, CVE-2026-120276, CVE-2026-120198, CVE-2026-120195, and CVE-2026-120240. These flaws, primarily involving command injection and stack-based buffer overflows, affect components such as DNS Resolution Handler, OpenVPN Handler, and WireGuard CLI Group Handler. Similar critical vulnerabilities have also been found in Linksys E8450 (CVE-2026-120283) and D-Link DIR-505 (CVE-2026-120189), also leading to stack-based buffer overflows. These vulnerabilities collectively expose a wide range of consumer networking devices to potential compromise, with many allowing for remote command execution. (GovInfoSecurity)